Assembly Language for Beginners

1.15. SWITCH()/CASE/DEFAULT

Here we see a jumptable:

Figure 1.52:OllyDbg: calculating destination address using jumptable

Here we’ve clicked “Follow in Dump”→“Address constant”, so now we see thejumptablein the data
window. These are 5 32-bit values^95. ECXis now 2, so the third element (can be indexed as 2^96 ) of the
table is to be used. It’s also possible to click “Follow in Dump”→“Memory address” and OllyDbg will show
the element addressed by theJMPinstruction. That’s0x010B103A.

(^95) They are underlined by OllyDbg because these are also FIXUPs:6.5.2 on page 759, we are going to come back to them later
(^96) About indexing, see also:3.19.3